id: Kenna - Search and Handle Asset Vulnerabilities
version: -1
fromversion: 5.0.0
name: Kenna - Search and Handle Asset Vulnerabilities
description: This playbook accepts an asset, then searches for vulnerabilities on that asset using the Kenna integration. If a vulnerability exists, it looks for relevant patches, lets the analyst deploy them and then generates an investigation summary report.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c9901727-39fe-43b9-8d68-a6957da9e30d
    type: start
    task:
      id: c9901727-39fe-43b9-8d68-a6957da9e30d
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: f4980703-8d81-44c7-83a4-60d8271e08c6
    type: title
    task:
      id: f4980703-8d81-44c7-83a4-60d8271e08c6
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: 56527b1b-e40b-4704-8694-a214d821c624
    type: title
    task:
      id: 56527b1b-e40b-4704-8694-a214d821c624
      version: -1
      name: CVE enrichment
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 365
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 6ea0dd13-c5d2-4734-8703-b05c9972f7d1
    type: condition
    task:
      id: 6ea0dd13-c5d2-4734-8703-b05c9972f7d1
      version: -1
      name: Are there available fixes?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Kenna
                accessor: Fixes.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: c6207ea1-0976-41d3-8636-17088f23b054
    type: regular
    task:
      id: c6207ea1-0976-41d3-8636-17088f23b054
      version: -1
      name: Manually deploy patch
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 692f4ab3-8daa-4c7c-86d1-1e610334de44
    type: regular
    task:
      id: 692f4ab3-8daa-4c7c-86d1-1e610334de44
      version: -1
      name: Generate investigation summary report
      description: |-
        A script that generates an investigation summary report. It can
        be used in a post-processing flow as well.
      scriptName: GenerateInvestigationSummaryReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      incidentId: {}
      name: {}
      type: {}
    separatecontext: false
    skipunavailable: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 6e60fb9f-34ba-4dc8-8f65-6ca730416a75
    type: regular
    task:
      id: 6e60fb9f-34ba-4dc8-8f65-6ca730416a75
      version: -1
      name: Kenna - search vulnerability
      description: Searches for vulnerabilities in Kenna.
      script: '|||kenna-search-vulnerabilities'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: VulnerabilitiesOfAsset.ID
      limit: {}
      min-score: {}
      status: {}
      to_context: {}
      top-priority: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: fb35ed00-0191-4630-8a07-9a41dc0f837d
    type: regular
    task:
      id: fb35ed00-0191-4630-8a07-9a41dc0f837d
      version: -1
      name: Kenna - get asset vulnerabilities
      description: Gets vulnerabilities of the specified asset.
      script: '|||kenna-get-asset-vulnerabilities'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: Assets.ID
      limit: {}
      to_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 9bfa446c-4fff-4a9b-82ac-3aa4b5e7f085
    type: regular
    task:
      id: 9bfa446c-4fff-4a9b-82ac-3aa4b5e7f085
      version: -1
      name: Kenna - search assets
      description: Searches for assets.
      script: '|||kenna-search-assets'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      hostname:
        complex:
          root: inputs.hostname
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostname
                iscontext: true
      id:
        complex:
          root: inputs.host_id
      limit: {}
      min-score: {}
      tags: {}
      to_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: edefc5de-0585-4b2e-837c-ef0963d91ed6
    type: regular
    task:
      id: edefc5de-0585-4b2e-837c-ef0963d91ed6
      version: -1
      name: Kenna - search fixes
      description: Filters fixes by a given set of vulnerability and asset parameters and returns the filtered fixes.
      script: '|||kenna-search-fixes'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: Vulnerabilities.ID
      limit: {}
      min-score: {}
      status: {}
      to_context: {}
      top-priority: {}
      vulnerabilities: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "21":
    id: "21"
    taskid: 6762ce1a-c1f2-4a01-8483-2bdab72945e3
    type: regular
    task:
      id: 6762ce1a-c1f2-4a01-8483-2bdab72945e3
      version: -1
      name: Kenna - add note for asset
      description: Add a comment for the asset describing the patch.
      script: '|||kenna-update-asset'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: Assets.ID
      notes:
        simple: Patched for vulnerability ${Kenna.Fixes.Vulnerabilities.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "22":
    id: "22"
    taskid: cfba542c-fbd4-45fd-8cf0-6653c237a697
    type: condition
    task:
      id: cfba542c-fbd4-45fd-8cf0-6653c237a697
      version: -1
      name: Were any vulnerabilities found?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Kenna
                accessor: Vulnerabilities.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 650,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "23":
    id: "23"
    taskid: 75dc8cb1-8b02-4d80-8ef4-e71dba6a4ecd
    type: title
    task:
      id: 75dc8cb1-8b02-4d80-8ef4-e71dba6a4ecd
      version: -1
      name: Remediation
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "24":
    id: "24"
    taskid: edb2be78-4470-4f0f-82fa-3d0aec9dc695
    type: condition
    task:
      id: edb2be78-4470-4f0f-82fa-3d0aec9dc695
      version: -1
      name: Is there a host to search?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.hostname
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.host_id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 360,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "25":
    id: "25"
    taskid: 96f5131e-4cae-4ed3-8022-43e4093d6b1e
    type: condition
    task:
      id: 96f5131e-4cae-4ed3-8022-43e4093d6b1e
      version: -1
      name: Is Kenna v2 integration enabled?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Kennav2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "11_13_yes": 0.51,
      "11_14_#default#": 0.39,
      "22_20_yes": 0.59,
      "22_9_#default#": 0.28,
      "24_9_#default#": 0.11,
      "25_9_#default#": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 2520,
        "width": 1550,
        "x": 50,
        "y": -520
      }
    }
  }
inputs:
- key: hostname
  value: {}
  required: false
  description: Hostname to search.
- key: host_id
  value: {}
  required: false
  description: Kenna host ID to search.
outputs:
- contextPath: Report.Name
  description: Report file name.
  type: string
- contextPath: Report.FileID
  description: File ID of the report.
  type: string
- contextPath: Kenna.Vulnerabilities.ID
  description: The vulnerability ID.
- contextPath: Kenna.VulnerabilitiesOfAsset.ID
  description: The ID of the vulnerability associated with the the asset.
- contextPath: Kenna.Fixes.ID
  description: The fix ID.
- contextPath: Kenna.Fixes.Assets.ID
  description: The asset ID related to the current fix.
- contextPath: Kenna.Fixes.Vulnerabilities.ID
  description: The vulnerability ID related to the current fix.
tests:
- No Test